CVE-2018-10896
High
Description
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
SeverityHigh
CVSS7.1
Exploit probability—
ProductCanonical Cloud-init
PublishedAug 1, 2018
First seenAug 1, 2018
Weakness typeCWE-321CWE-321
How to fix
Update
- canonical cloud-init18.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| canonical cloud-init | 0.6.2 ≤ v < 18.4 | 18.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.